Privacy Policy
Caliper Checkout Rules · last updated 7 August 2026
Caliper Checkout Rules is a Shopify app that enforces purchase rules a merchant configures — quantity limits, order minimums, purchase multiples, and blocked combinations — inside Shopify’s checkout. It also re-checks completed orders and reports ones that broke those rules after arriving through channels where checkout validation cannot run.
This document describes everything the app processes and doubles as our data processing terms with merchants (see Data processing terms). It is deliberately specific rather than broad: the lists below are exhaustive, not illustrative.
Two different things are covered, and the distinction runs through the whole document. Shopper data is what a store’s customers generate, and the merchant is its controller. There is also merchant data, which is the store’s own: the shop domain, the access token Shopify issues at install (destroyed when the app is uninstalled), and the rules and revision history the merchant writes. That is not personal data about a shopper, but this document said “exhaustive” and then described only the first kind, so it is named here.
Our role
For personal data belonging to a store’s customers, the merchant is the controller and Caliper is a processor. We process that data only to run the rules the merchant themselves configured, and only on their instruction. We never use it for our own purposes.
What we process
Caliper runs in three places. Each sees a different slice, and none sees more than the rules require.
1. Inside Shopify’s checkout
A Shopify Function evaluates the cart during checkout. It receives, in memory, only:
- whether the customer carries specific tags — and only tags named by one of the merchant’s rules. The Function asks Shopify a yes/no question per named tag, so it is structurally incapable of learning any other tag a customer has.
- whether the order is a B2B purchase
- the cart subtotal and currency
- per line: quantity, product, variant, line subtotal, and collection membership
- the buyer’s country, market and language
Caliper stores none of this. Note that Shopify itself records the inputs and outputs of every Function run on its own platform, under Shopify’s privacy terms rather than ours.
2. On the storefront (optional)
If the merchant enables the storefront extension, the same rules are evaluated in the shopper’s browser to warn them before checkout. It reads the cart contents, the country/language/market, whether the shopper belongs to a B2B company, and only those customer tags a rule names. Evaluation happens entirely in the browser.
This extension sets no cookies. It writes nothing to local storage, session storage, or any other browser storage. It creates no identifier, sends no analytics, and contacts no server other than the merchant’s own store and Shopify’s CDN.
3. After an order is placed
Shopify notifies us when an order is created. That notification contains the full order, including the customer’s name, email, phone and addresses. We do not read those fields. The only values taken from it are:
- the order’s reference, date and currency
- line items: quantity, product, variant and unit price
- the customer tags a rule names, and nothing else
- whether it was a B2B order
- how the order was placed (point of sale, subscription renewal, API, and so on) — this is what tells the merchant whether a violation was something any app could have prevented
If the order satisfies every rule, nothing is stored at all. If it broke one, we keep a record of that violation so the merchant can see it.
What we never collect
No code path in Caliper reads a customer’s name, email address, phone number, or postal address. This is a design constraint, not an oversight — we gave up the ability to apply country-specific rules to completed orders rather than read a shipping address for its country code.
We also carry no analytics, advertising, attribution, tracking or error-reporting service of any kind. There is no third party inside this app.
How long we keep it
| What | Kept for |
|---|---|
| Checkout evaluations | Not stored at all |
| Storefront evaluations | Not stored at all; never leave the browser |
| Records of orders that broke a rule | Your plan’s window — 7, 30 or 365 days — after which they are deleted automatically, whether or not anyone opens the app. Never kept beyond 365 days in any case. |
| The merchant’s own rules and settings | Until 48 hours after the app is uninstalled, so that reinstalling does not lose your configuration |
| Customer data requests forwarded by Shopify | Kept while open, because an open request is an obligation with a deadline. Once you mark one answered it is deleted on the same window as the order records above. The order numbers a request names are removed immediately if that customer later asks to be erased. |
When a merchant uninstalls, their access credentials are destroyed immediately. Shopify then instructs us to erase the store 48 hours later, and at that point everything belonging to that store is deleted — rules, revision history, and every violation record.
Where it is processed
Caliper runs on Railway in the United States (US West), using a managed PostgreSQL database. Railway and Shopify are our only sub-processors; there are no others.
Security
- All data in transit is encrypted with TLS.
- The database is encrypted at rest by our hosting provider.
- Every request from Shopify is cryptographically verified before it is processed; unverified requests are rejected.
- Every database query is scoped to a single store, so one merchant’s data is not reachable from another’s session.
- Access to production systems is limited to the operator of the service.
Automated decisions
Caliper automatically prevents a checkout from completing when the cart does not satisfy a rule the merchant configured — for example, a limit of two per order. The decision is based on the contents of the cart, and where the merchant has scoped a rule that way, on customer tags, country or B2B status.
The shopper is shown the merchant’s own explanation and can adjust the cart and complete the purchase. Nothing is decided about the shopper as a person, no profile is built, and no record of a blocked checkout is created. Shoppers who want a decision reviewed should contact the store directly, since the rule and the remedy are the merchant’s.
Selling and sharing
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used under the CCPA/CPRA and comparable laws. We never have.
Your rights
If you are a shopper, the store you bought from is the controller of your data — contact them, and they can reach us. Shopify provides merchants with the mechanisms to pass on requests, and Caliper honours them automatically:
- Access. We report everything we hold for the orders named in a request. Since we hold no name, email, phone or address, that is limited to the order reference, what was ordered, the relevant customer tags, and which rules the order did not satisfy.
- Erasure. On request we delete our records for the orders named, permanently and immediately.
- Store erasure. When a store is closed or the app removed, everything for that store is deleted.
Depending on where you live you may also have rights to correct or port your data, or to object to processing. Raise these with the merchant, or write to us at support@calipercommerce.com.
Data processing terms
These terms apply between Caliper (processor) and each merchant (controller) who installs the app, and take effect on installation.
- Subject matter and duration. Processing customer data to evaluate the merchant’s configured purchase rules, for as long as the app is installed, plus the erasure period described above.
- Nature and purpose. Evaluating carts and completed orders against those rules, and reporting the results to the merchant. No other purpose.
- Types of data. As enumerated under What we process — cart and order contents, customer tags a rule names, B2B status, country, market and language. No direct identifiers.
- Data subjects. Customers and visitors of the merchant’s store.
- Instructions. We process only on the merchant’s documented instructions, which the app’s configuration expresses.
- Confidentiality. Anyone with access to personal data is bound to keep it confidential.
- Security. The measures listed under Security above.
- Sub-processors. Railway (hosting and database) and Shopify. We will give notice before adding another, so the merchant can object.
- Assistance. We help the merchant respond to data subject requests, and notify them without undue delay if we become aware of a breach affecting their data.
- Deletion. On uninstall and store closure, as above.
- Audit. We make information available to demonstrate compliance with these terms on reasonable request.
Changes
If what we process changes, this page changes with it, and the date at the top is updated. Material changes will be communicated to installed merchants.